Trust and scope

Safety Model

Review the boundaries that keep inspection, repository writes, comparison, release preparation, Git history, and database execution separate.

DbState is intentionally review-first. It improves visibility into database state without taking over database execution or Git history.

Key boundaries

The safety model separates:

Database inspection from database execution
Repository writes from Git history
State comparison from database mutation
Release Plans from SQL execution
Reference-data comparison from data manipulation

Repository writes require explicit workflows. Git history remains user-controlled. Repository-to-Database comparison is read-only.

Destructive SQL is not generated by default. Changed, database-only, or unsupported differences may remain manual-review cases.

PostgreSQL passwords are not stored by DbState.

Reference-data posture

Reference-data comparison is conservative. Users choose tables and comparison rules, and Repository-to-Database comparison does not automatically generate INSERT, UPDATE, DELETE, or MERGE.

Database-only rows remain manual-review cases because they may still be referenced by foreign keys or retain historical meaning.

Review-first does not mean risk-free

DbState does not guarantee:

Error-free SQL
Zero incidents
Regulatory compliance
Automatic rollback
Complete detection of every consequence
Correctness of externally edited files
Correctness of SQL executed outside DbState

Human review and operational release controls remain necessary.

Read the full public Safety Model page for the complete explanation.